{"record":{"id":"6c16d572d4ec08be","repo":"vxcontrol/pentagi","slug":"token-required","errorCode":null,"errorMessage":"token required","messagePattern":"token required","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"backend/pkg/server/auth/auth_middleware.go","lineNumber":199,"sourceCode":"\tc.Set(\"rid\", rid.(uint64))\n\tc.Set(\"exp\", exp.(int64))\n\tc.Set(\"gtm\", gtm.(int64))\n\tc.Set(\"tid\", tid.(string))\n\tc.Set(\"uname\", uname.(string))\n\n\tif slices.Contains(prms, PrivilegeAutomation) {\n\t\tc.Set(\"cpt\", \"automation\")\n\t}\n\n\treturn authResultOk, nil\n}\n\nconst PrivilegeAutomation = \"pentagi.automation\"\n\nfunc (p *AuthMiddleware) tryProtoTokenAuthentication(c *gin.Context) (authResult, error) {\n\tauthHeader := c.Request.Header.Get(\"Authorization\")\n\tif authHeader == \"\" {\n\t\treturn authResultSkip, errors.New(\"token required\")\n\t}\n\n\tif !strings.HasPrefix(authHeader, \"Bearer \") {\n\t\treturn authResultSkip, errors.New(\"bearer scheme must be used\")\n\t}\n\ttoken := authHeader[7:]\n\tif token == \"\" {\n\t\treturn authResultSkip, errors.New(\"token can't be empty\")\n\t}\n\n\t// skip validation if using default salt (for backward compatibility)\n\tif p.globalSalt == \"\" || p.globalSalt == \"salt\" {\n\t\treturn authResultSkip, errors.New(\"token validation disabled with default salt\")\n\t}\n\n\t// try to validate as API token first (new format with JWT signing key)\n\tapiClaims, apiErr := ValidateAPIToken(token, p.globalSalt)\n\tif apiErr != nil {","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/vxcontrol/pentagi/blob/ea665308baaff015b226f308438a68d929d0f29b/backend/pkg/server/auth/auth_middleware.go#L181-L217","documentation":"tryProtoTokenAuthentication inspects the Authorization header for a Bearer API token. When the header is entirely absent the middleware returns authResultSkip with 'token required', meaning this authentication method does not apply and other methods (e.g. session cookie) are attempted. If no method succeeds, the request ends up unauthorized.","triggerScenarios":"Calling an API endpoint programmatically (curl, scripts, CI) without any Authorization header; removing the header accidentally in an HTTP client config; browser requests that dropped cookies AND carried no bearer token, leaving no auth method available.","commonSituations":"Forgetting to pass -H 'Authorization: Bearer <token>' in curl; API client library configured without default auth headers; reverse proxy stripping the Authorization header; automation tokens not yet generated in settings.","solutions":["Add the header Authorization: Bearer <your-api-token> to the request","Generate an API token in the settings UI if you do not have one","If a proxy sits in front of the API, verify it does not strip the Authorization header"],"exampleFix":"// before\ncurl https://localhost:8443/api/v1/flows\n// after\ncurl -H 'Authorization: Bearer <token>' https://localhost:8443/api/v1/flows","handlingStrategy":"validation","validationCode":"if (!localStorage.getItem('apiToken')) throw new Error('Configure an API token before calling the API');\n// and always attach it:\nheaders: { Authorization: `Bearer ${localStorage.getItem('apiToken')}` }","typeGuard":"const hasBearer = (h: Record<string,string>): boolean =>\n  typeof h.Authorization === 'string' && h.Authorization.startsWith('Bearer ') && h.Authorization.length > 7;","tryCatchPattern":"try {\n  const res = await api.call();\n} catch (e) {\n  if (e.response?.status === 401) {\n    // no/invalid token: prompt user to configure an API token\n    promptForTokenSetup();\n  }\n  throw e;\n}","preventionTips":["Set default auth headers in your HTTP client once (axios defaults / interceptor)","Generate and store API tokens before scripting against the REST API","Verify reverse proxies do not strip the Authorization header"],"tags":["authentication","api-token","http-headers"],"backgroundTag":"missing-auth-token","analyzedSha":"ea665308baaff015b226f308438a68d929d0f29b","analyzedAt":"2026-09-01T14:16:31.421Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}